Privacy Policy

Last updated: 28 September 2026

This policy explains what personal data HIIT Count collects, why, and your choices. The short version: we collect as little as we can, we don't sell your data and we don't show ads. Our own visit statistics use no cookies at all. The one third-party analytics tool we use, Google Analytics, loads only if you accept it.

1. Who is responsible

The controller of your personal data is Generic Ventures - e-Commerce, Digital Products & Services, LDA (NIPC 517877538), Braga, Portugal. For any privacy question or request, email [email protected].

2. What we collect

When you use the timer without an account

• Workouts you finish: the workout type, treadmill or outdoor, interval lengths, number of rounds, total time, the coach you chose, and start and finish times. These are stored without your name or email.
• Usage events: a small number of named events, such as "workout started", "workout completed" or "coach selected", with basic details like the workout type. We use them to understand which features are used. They are not linked to you unless you are signed in.
• Cookieless visit statistics: so we can tell which of our pages are useful, we record each page you open together with the workout type or kind of page it was, the language version, a two-letter country code, which site or search engine sent you (the website name only, never the full link), the name of the ad or post you followed if its link carried one (for example “instagram/spring-ad”), and whether you are on a phone, tablet or desktop. Pages you open in the same browser tab share a random number so we can count one visit rather than five. That number exists only in your browser tab's memory for as long as the tab is open: it is not a cookie, nothing is saved to your device, and reloading the page starts a new one. So these statistics cannot be joined up across visits, cannot be linked to you, and are never linked to your account even when you are signed in. We never store your IP address — it is used only for a moment to work out the country and to stop flooding.
• Google Analytics — only if you accept it: if you choose "Accept" on the cookie notice, we load Google Analytics 4, which sets its own cookies and records the pages you view and the actions listed above. Your IP address is anonymised before Google stores it. If you choose "Decline", or simply ignore the notice, it is never loaded at all — not loaded and held back, but absent from the page. You can change your mind by clearing this site's cookies, which makes the notice appear again. We never load it on admin pages.
• On your device only: your settings (language, coach, runner, outfit, scene, units, warm-up) and a history of your finished workouts are kept in your browser's storage so badges and records work without an account. We don't receive this unless you sign in (see below).

When you have an account

• Account details: your email address, preferred language and, if you turn on the weekly coach report, your time zone and email preference.
• Your name, if you give one: what you ask the coach to call you. We use it to greet you in the weekly coach report and to record the coach saying it, on our own servers (no outside voice service). The recordings are stored by name, not linked to your account, and nobody else is ever sent yours. Clear the name in Settings at any time.
• Training data: your workouts (as above) linked to your account, training-plan progress and saved custom workouts.
• Sign-in sessions: a session record so you stay signed in.
• Email delivery records: for each email we send you, we keep the address, the subject, the language and whether it was accepted or rejected, so we can tell when a sign-in link fails to arrive. We do not keep the contents of the message.
• Workouts from before you signed in: when you sign in, the workouts recorded in your browser are added to your account so your history is complete. Only do this on a device you use yourself.

When you buy Premium

• Subscription records: your Stripe customer reference, plan, regional price tier, amount, currency, dates and subscription status.
• Payment details (card number and similar) are collected and held by Stripe, not by us.
• Your country is worked out from your internet connection when you view prices, to choose the right regional price. We don't store it separately.

Technical data

Like any website, our servers receive your IP address, browser type and the pages you request. These appear in server logs used for security and troubleshooting, which are deleted after a short period (normally about two weeks).

What we don't collect

We don't currently collect heart rate or other health measurements from sensors or watches. If we add such features, we will ask for your explicit consent first and update this policy before they launch.

3. Why we use it (and our legal basis)

• To provide the service you asked for: running workouts, your account, history, badges, plans and Premium (performance of a contract).
• To send emails you asked for: sign-in links (contract) and the weekly coach report (your consent, which you can turn off at any time on your dashboard or from the link in each email).
• To keep HIIT Count secure and working, prevent abuse, and understand and improve how features are used through our own first-party statistics (our legitimate interests).
• To meet legal obligations, such as keeping payment records for tax purposes.

We don't use your data for advertising, we don't sell it, and we don't make automated decisions about you that have legal or similarly significant effects.

4. Who we share it with

We use a small number of service providers who process data on our behalf, under contracts that protect it:

• Hetzner Online (Germany): the servers that host HIIT Count and its database.
• Cloudflare: network delivery and security for the website, and storage of audio files.
• Stripe: payments and subscription management.
• Google (Google Analytics): visit statistics, only for visitors who accept the cookie notice.

Emails are sent from our own mail server. The coach voice uses recorded clips or your device's built-in speech engine; only the coach's own lines are spoken, never your personal data. We may also disclose data if the law requires it, or to a buyer if the business is transferred (with this policy continuing to apply).

5. International transfers

Our servers are in the European Union. Some providers, such as Stripe and Cloudflare, may process data in other countries, including the United States. Where that happens, transfers are protected by recognised safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

6. How long we keep it

• Account and training data: until you delete your account.
• Workouts saved without an account and usage events: kept in anonymous form for statistics.
• Cookieless visit statistics: up to 12 months, then deleted automatically.
• Google Analytics data (only if you accepted): held by Google under their retention settings, currently 14 months.
• Email delivery records: up to 12 months, then deleted automatically.
• Sign-in sessions: up to 30 days.
• Payment and subscription records: as long as tax and accounting law requires.
• Server logs: normally about two weeks.

7. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have it corrected or deleted;
• receive your training data in a portable format;
• object to or restrict certain uses, and withdraw consent at any time;
• complain to your local data-protection authority.

To use any of these rights, including deleting your account, email [email protected] from the address on your account. We will reply within one month. There is no charge.

8. Cookies and device storage

These are needed for the service to work, so they are set without asking:

• a sign-in cookie that keeps you signed in;
• a language cookie that remembers your language;
• a cookie recording your answer to the cookie notice, so we only ask once;
• browser storage for your settings and on-device workout history (described above).

One thing is optional, and that is what the cookie notice asks about: Google Analytics. It is the only cookie we set that isn't needed to run the service, and it is not set unless you accept.

We don't use advertising or social-media cookies, and we don't track you across other websites. Our own visit statistics (described in section 2) deliberately use no cookies and no device storage at all, which is why they need no consent and run whatever you choose. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.

9. Security

Connections are encrypted (HTTPS), sign-in uses one-time email links instead of passwords, and access to our servers and database is restricted. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authorities as the law requires.

10. Children

HIIT Count is not intended for children under 16. We don't knowingly collect their data; if you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We will post any changes here with a new date and, for significant changes, tell signed-in users before they apply. See also our Terms of Service.